Britain's high-street banks, already reeling from the cost of the payment protection insurance scandal, could be forced to pay out hundreds of millions of pounds more to compensate customers for a widely mis-sold card protection product.

Of the £33.4m, CPP expects £14.5m to be paid to customers mis-sold its card protection and identity protection products between January 2005 and March 2011. However, this only covers direct sales made by CPP; the vast majority of sales were made via high street banks including Santander and HSBC.

A number of the banks "introduced" their customers to CPP by affixing a sticker to new credit or debit cards sent to customers. The sticker prompted the customer to call a number, which was CPP's, either to activate the card or to confirm receipt of it. When the customer did ring, CPP also used the opportunity to offer card protection and/or identity theft protection to the customer.

CPP, which has suffered a collapse in its share price since its flotation at 235p in 2010, will pay the £10.5m fine in instalments. The fine is a joint record for a retail-related offence, on a par with the one slapped on HSBC last December for misselling investments to eldery customers.

Paul Stobart, the new CPP chief executive, said: "We are deeply sorry for the errors and wrongdoings of the past and are paying a heavy penalty through what is a large fine. "Today marks the end of the long-running investigation into historic practices at CPP in the UK." The shares closed last night at 25.25p.

The CPP card protection product would offer to cancel all a cardholder's cards if they went missing or were stolen. It also offered key cover and an emergency cash advance. But the element of the product the FSA objected to was the £100,000 of card protection – this was not needed because customers are already covered by their banks in almost all cases if their cards are stolen.

The FSA also said identity protection was mis-sold because CPP overstated the risks and consequences of identity theft during sales of the product. The card insurance cost £35 a year while the identity theft cover was sold for £84.

"While CPP's products were relatively inexpensive, they were sold widely and CPP encouraged its sales agents to be overly persistent," Tracey McDermott, the FSA's director of enforcement and financial crime said. "This exposed a very large number of customers to the unacceptable risk of buying products they did not want or need."

CPP will be writing to customers it believes have been affected, but not until discussions between itself, the FSA and the banks have concluded. A special fund is expected to be created for this purpose.

Customers are being urged to contact CPP or their bank to claim. Customers can only claim for policies taken out between January 2005 when the FSA started regulating general insurance, and March 2011 when the FSA first started dealing with CPP over the issue.

During this period CPP sold 4.4m card protection and identity protection policies and received £188.3m in customer payments, a proportion of which it paid to the banks for an introduction fee. CPP also renewed 18.7m policies for which it received £656.5m in customer payments, a proportion of which it again paid to the banks for an introduction fee.

Santander has already taken an unspecified provision to cover CPP, included in a charge of £232m in its third quarter results.

Santander said it still uses CPP for its card activation process but no longer sells the company's insurance products. It said when it did sell the insurance via card activation it was made clear to the caller that the company the customer was dealing with was CPP, not Santander.

HSBC said it did not use the card activation process to sell CPP's products, but confirmed it did sell the company's card protection product to customers. It is believed Barclays sold the insurance via its card activation process and that the caller thought they were buying from Barclays not CPP.

Neither Lloyds TSB or Halifax had a relationship with CPP. Bank of Scotland did many years ago – currently, about 19,000 customers on older products have CPP cover. However, all of these products were sold prior to 2003.

The Guardian is still awaiting comment from Barclays and RBS.

One industry source suggested claims management companies that have made millions from dealing with people's PPI claims could "be all over CPP claims" in the near future.

The CPP website still lists the company's card protection policy but anyone clicking on the "buy now" button is taken to a message reading: "Unfortunately this product is no longer available." The company is no longer selling identity protection but is selling a product called identity theft, which is similar but does not contain the insurance element of the previous product.